Skip to content

Fix Log Prefix Formation with Multi-Account Organization Support in C… - #2815

Open
laiquesantana wants to merge 1 commit into
aws:masterfrom
laiquesantana:enhancement/add-organization-template-cloud-trail
Open

Fix Log Prefix Formation with Multi-Account Organization Support in C…#2815
laiquesantana wants to merge 1 commit into
aws:masterfrom
laiquesantana:enhancement/add-organization-template-cloud-trail

Conversation

@laiquesantana

Copy link
Copy Markdown

Description:
This PR introduces a necessary change to the AWS SDK PHP to address an issue encountered during the configuration of AWS CloudTrail with the 'Enable for all accounts in my organization' option. This setting introduces an additional directory layer after AWSLogs to accommodate organization IDs, which was not accounted for in the existing SDK logic. As a result, log retrieval for multi-account setups within an organization was failing. The implemented fix normalizes the log prefix, ensuring that the SDK can successfully access and iterate over log files in S3 buckets across multiple AWS accounts with the organization feature enabled.

Impact:
This update ensures seamless functionality for new multi-account organizational setups while preserving the behavior for existing single-account implementations. It's an optional adjustment that only affects users who opt into organization-level logging.

@stobrien89 stobrien89 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @laiquesantana,

Apologies for the delay. I'm not familiar with the specific cloudtrail setting you mentioned, but it seems like this should be configurable (pass in the prefix) or somehow based on whether or not the setting is enabled.

// For internal use
const DEFAULT_TRAIL_NAME = 'Default';
const PREFIX_TEMPLATE = 'prefix/AWSLogs/account/CloudTrail/region/date/';
const PREFIX_TEMPLATE = 'prefix/AWSLogs/organization/account/CloudTrail/region/date/';

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This might be a breaking change. Is there a way to tell if 'Enable for all accounts in my organization' is enabled first?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants